App self-update and macOS code signing / notarization #120

Status — pipeline ready; signing credentials not configured, so releases ship unsigned (updated 2026-10-15)

Everything automatable for macOS signing is done, but it has never been switched on: the repository has no MACOS_* secrets (only the ANDROID_* and AUR_SSH_PRIVATE_KEY secrets exist), so every release through v0.2.4 (2026-10-12) took the unsigned path (.github/workflows/release.yml:209). README.md:170-171 and the release notes (release.yml:350-352) still tell users to clear quarantine with xattr -dr com.apple.quarantine.

Shipped:

• In-app update check (PR feat: app update-available check via GitHub releases #255) — checks GitHub Releases for a newer tcode version on the existing provider version-check cadence; a newer release raises a notice + a download row that opens the release page (crates/runtime/src/app/providers.rs:241, :801-806).
• Signing & notarization pipeline (PR ci: Developer ID sign + notarize macOS release builds when configured #269) — the release workflow signs (Developer ID + hardened runtime + entitlements), notarizes, and staples both the app and the DMG whenever six MACOS_* secrets are configured. Absent the secrets it ships unsigned builds exactly as before, so tags never fail to publish; a partial set fails the job naming the missing secrets (release.yml:197-210).

Left to do:

1. macOS credentials (needs the maintainer's Apple Developer account; cannot be automated). Add the six secrets listed with how to obtain each in the comment above the signing step (.github/workflows/release.yml:162-179; also CONTRIBUTING › Release signing): Developer ID .p12 (base64), its password, the identity string, Apple ID, Team ID, and an app-specific password. Then a signed release stops needing xattr -dr com.apple.quarantine. Verify with a v0.0.0-signtest prerelease.
2. Windows code signing (optional) — an OV/EV cert would remove SmartScreen friction; the workflow has no Windows signing step and ships unsigned Windows zips today.
3. Self-updating installer (Sparkle-style appcast) — not started (no updater or appcast code on main at e292f501); deliberately deferred until signed builds exist. The in-app update-available surface is the entry point for it when built.

Keeping this open as the tracker for the credential step + the two optional follow-ups.